Splunk Search

Problem with rex and stats count

jpvh12345
New Member

I have single-line log entries that come into splunk looking like this:
Apr 1 12:34:09 10.1.9.254 %ASA-4-722051: Group User IP <108.81.41.121> Address <172.31.255.91> assigned to session
Each entry represents a single login.
I would like to have a count of all log entries with individual names that follow in the <> after the "User" phrase. User is not a field defined so it has to be done with a rex or something at search time.
The last thing I've tried is:
| rex field=_raw "User\s(?)" | stats count by _raw
but all I get with this is a listing of the individual log entries.

Tags (1)
0 Karma
1 Solution

marcoscala
Builder

Search something like

Group user ip assignment to session | stats count as "login number"

That's it.

If instead you want to really use "Rex" you can do something like

....| rex "User\s<(?[^>]+)> | stats count(user)

And forget _raw.

Marco

View solution in original post

0 Karma

jpvh12345
New Member

I futzed around with the rex Marco sent and it worked. Just for historical purposes, the rex for this is:
rex "User\s<(?[^>]+)>" | stats count by user
Thanks again.

0 Karma

marcoscala
Builder

good job.
in that way you have the different login for each different user. My stats was counting all events where the field user had a value.

Marco

0 Karma

jpvh12345
New Member

Thank you, but no, I had already tried stats count by user and that didn't work.

0 Karma

linu1988
Champion

you are correct. But you only miss a small thing in count.

|stats count by user

marcoscala
Builder

Search something like

Group user ip assignment to session | stats count as "login number"

That's it.

If instead you want to really use "Rex" you can do something like

....| rex "User\s<(?[^>]+)> | stats count(user)

And forget _raw.

Marco

0 Karma

marcoscala
Builder

sorry folks for some confusion.. I was writing from my iPad and there was some extra capitalization due to autocorrect....
Marco

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...